Subject: [ietf-dkim] I send nothing

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Jul 2006 12:58:10 -0700

That is not true.

I sign everything will still result in messages that have failed sigs due to mailing lists and such.

I send nothing is much more categorical. The data can go straight to the bit bucket

SSP is not very relevant in this case as that spec is not on standards track and DKIM is.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Mark Delany
> Sent: Wednesday, July 26, 2006 11:57 AM
> To: [email-masked]
> Subject: Re: [ietf-dkim] The URL to my paper describing the 
> DKIM policy options
> 
> On Wed, Jul 26, 2006 at 04:30:15PM +0100, Stephen Farrell 
> allegedly wrote:
> 
> > I've always wondered why dkim is taking on the task of 
> supporting "I 
> > don't send mail" since the statement makes no reference to 
> signatures 
> > at all. Arguably, that's something that should be dealt with by 
> > someone else, who might also think about saying "I only send mail 
> > that's less than 1MB", or, "I only send invoices".
> 
> Especially since one can achieve that same effect by having 
> an SSP that says "I sign" everything and then don't sign any email.
> 
> 
> Mark.
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Steve Atkins <[email-masked]>
Date: Wed, 26 Jul 2006 16:25:01 -0700

> I send nothing is much more categorical. The data can go straight  

But surely if you assert "I sign everything" then any mail that is
unsigned (where "signature corrupted by mailing list" is identical
to unsigned) should go straight to the bitbucket.

Or are you suggesting that an email from a sender who
"signs everything" that arrives with an invalid signature should be
treated as valid? If so, DKIM+SSP is worthless. If not, then the two
assertions are identical in result.

(One may consume a little more CPU than the other, but that's
really not going to be an issue, for the obvious reasons).

Cheers,
   Steve

---

From: Douglas Otis <[email-masked]>
Date: Wed, 26 Jul 2006 17:01:09 -0700

> to unsigned) should go straight to the bitbucket.

No.  Invalid signatures are to be ignored.  In the case of a mailing  
list, an invalid signature may be common for many years.  Only when  
there is an assertion that mail is never sent, can mail be outright  
rejected, however scant.

> Or are you suggesting that an email from a sender who "signs  
> everything" that arrives with an invalid signature should be  
> treated as valid? If so, DKIM+SSP is worthless. If not, then the  
> two assertions are identical in result.

The real value would be found including Designated Signing Domain  
Lists as part of the policy. Annotations that an email-address is  
associated with the signing domain could provide value from an  
assurance standpoint.

-Doug

---

From: Steve Atkins <[email-masked]>
Date: Wed, 26 Jul 2006 17:06:09 -0700

On Jul 26, 2006, at 5:01 PM, Douglas Otis wrote:

> No.  Invalid signatures are to be ignored.  In the case of a  
> mailing list, an invalid signature may be common for many years.   
> Only when there is an assertion that mail is never sent, can mail  
> be outright rejected, however scant.

If a sender asserts that all mail is signed, and you receive mail  
purporting to be from that sender that isn't signed, are you  
suggesting that it should be delivered anyway? If so, what's the  
point of the sender asserting that all legitimate mail from them is  
signed?

Cheers,
   Steve

---

From: Michael Thomas <[email-masked]>
Date: Wed, 26 Jul 2006 17:13:01 -0700

>SSP is not very relevant in this case as that spec is not on standards track and DKIM is.

There seems to be two different cases of "I sign everything" that people 
have
in mind. Mark's novel use seems to be the same categorical statement that
bigbank.com would make: "if you see something purportedly from me that
isn't signed, by all means treat with extreme prejudice".

The second use case is "I sign everything, but don't be too surprised if 
there
are legitimate messages that lack valid signatures." This is the 
situation that many
companies including mine will be in once we're signing everything. Is 
this a
useful piece of information for receivers? My suspicion is that things 
like, oh
say, spamassassin could make use of that when evaluating the sum total of a
message's spamminess.

Along with these two cases, we have the open question of, exactly, the 
policy
is saying. Is it giving instructions or preferences to receivers, or is 
it just making
a statement about what it does? I sort of thought that there was a 
preference for
the latter kind of statement. If so, how does one phrase these two kinds 
of categories?

       Mike

---

From: Michael Thomas <[email-masked]>
Date: Wed, 26 Jul 2006 17:29:07 -0700

> point of the sender asserting that all legitimate mail from them is  

I think that a guiding principle that has served us well here is that 
decisions
about what to do with the information provided to the receiver is strictly
up to the local policy of the receiver. Phrasing this as an information 
service
rather than the signer trying tell a receiver what to do seems like a 
much more
likely path to success to me.

       Mike

---

From: Douglas Otis <[email-masked]>
Date: Wed, 26 Jul 2006 17:38:44 -0700

> point of the sender asserting that all legitimate mail from them is  

Not exactly.  Although an invalid signature purporting to be from one  
of the required domains could easily be added by a bad-actor, a valid  
signature might also become invalid due to improper handling.

Policy indicates initial conditions, such as what domains will sign  
the message.  When the list is closed-ended, this indicates there is  
a limited set of signatures associated with the OA.  When the list is  
open-ended, the OA may have been signed by an unknown signer, may not  
have been signed, or have may have had a signature damaged.

In the case where the list is closed-ended and the signature is  
invalid, unless there is mitigating reasons, the message may be  
refused depending upon DKIM's track record for signature failure.  
Policy does not dictate what gets rejected, only what the sender  
indicates as the initial conditions.

-Doug

---

From: Mark Delany <[email-masked]>
Date: Thu, 27 Jul 2006 00:50:41 +0000

> point of the sender asserting that all legitimate mail from them is  

+1

If a verifier ignores the "I sign everything" policy then they are
just as likely to ignore the "I send nothing" bit, where-ever that bit
may live.

There is a non-minor matter. Which "I" is not sending? From:, Sender:,
2821.MailFrom? All of the above?

Avoiding a re-dredge of that schizophrenia is going to be *quite* the
challenge.

Mark.

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 26 Jul 2006 21:09:54 -0400

> SSP is not very relevant in this case as that spec is not on standards

Last I checked, it was DKIM-base and DKIM-SSP and it's all supposed to be on 
standards track.  Has this changed?

Scott K

---

From: "Hector Santos" <[email-masked]>
Date: Wed, 26 Jul 2006 21:33:49 -0400

----- Original Message -----
From: "Michael Thomas" <[email-masked]>
To: "Steve Atkins" <[email-masked]>

> I think that a guiding principle that has served us well here
> is that decisions about what to do with the information provided
> to the receiver is strictly up to the local policy of the receiver.
> Phrasing this as an information service rather than the signer trying
> tell a receiver what to do seems like a much more likely path to
> success to me.

I think this is a +1.

In the final analysis, if a domain wants to have a signing policy which
allows for failure,  it should not expect mail receivers to tolerate the
high potential for exploitation and abuse.

I can almost assure you with 100% certainty we will be uss any new level of
non-legacy information (that we lacked before) made available, whether its
DKIM today or the new mouse trap tomorrow, to provide stronger mail
filtering rules based on a new level on non-legacy operations.

So if the BAD GUY wants to avoid this new level of scrunity, he will quickly
realized that his best recourse is to avoid DKIM domains because that puts
back into the legacy mode considerations.

The DKIM domain with relaxed signing provision is only going to hurts its
own reputation, especially as the ratio of FAILURE/SUCCESS gets higher and
higher.

Thats nothing new I am saying.  We do this today with everything else that
is out there.  We detect what we can and reject it.  The problem has always
been about the legacy mail client.  There is no rules to strong rules to
control the abuse of legacy operations.   But as soom as a DOMAIN begin or
MAIL comes in with purported DKIM markings, we are in a whole new world
baby!!

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

---

From: Arvel Hathcock <[email-masked]>
Date: Thu, 27 Jul 2006 02:40:48 -0500

> Last I checked, it was DKIM-base and DKIM-SSP and it's all supposed to
 > be on standards track.  Has this changed?

Not that I know of.

DKIM-SSP is every bit as important as DKIM-base.  For many people 
DKIM-SSP is _the_ interesting thing about this entire exercise. 
DKIM-base, while useful on it's own, is for many just a means to an end. 
  The end being the ability to communicate something from the domain 
owner concerning the use of his domain name in an email message.

-- 
Arvel

---

From: Arvel Hathcock <[email-masked]>
Date: Thu, 27 Jul 2006 02:41:36 -0500

> Avoiding a re-dredge of that schizophrenia is going to be *quite* the

We might not be able to avoid it.  Thus far we've preferred the From: 
with the rational that this is what's presented in an MUA.  I agree 
there are some problems here.

-- 
Arvel

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 27 Jul 2006 05:36:18 -0400

----- Original Message -----
From: "Arvel Hathcock" <[email-masked]>

> owner concerning the use of his domain name in an email message.

Major +1!

SSP and/or domain signature authorization protocol (DSAP) concepts is the
name of the game and IMV where DKIM will be measured from.

Since DKIM-BASE is on its way to standardization,  we need to pay careful
attention to separate any conflictive concepts such as certification
and/or reputation services (lets call them DKIM-C/R) attempting to water
down
DKIM-SSP fundamental domain signing policies.

These are two different concepts.